"Yes hacking is wrong, but that is not an excuse for companies to abdicate their security obligations. TalkTalk should and could have done more to safeguard its customer information. It did not and we have taken action."

The ICO also said that vulnerabilities in TalkTalk's system enabled hackers to gain access to the customer database.

"The data was taken from an underlying customer database that was part of TalkTalk's acquisition of Tiscali's UK operations in 2009," the ICO said.

(Dominic Lipinski/PA)

"The data was accessed through an attack on three vulnerable webpages within the inherited infrastructure. TalkTalk failed to properly scan this infrastructure for possible threats and so was unaware the vulnerable pages existed or that they enabled access to a database that held customer information."

The attack was said to have used a common technique known as SQL injection, a bug that is well known and for which defences already exist, the ICO investigation said, adding that TalkTalk "ought to have known it posed a risk to their data".

"The company said it did not know at the time that the software was affected by a bug - for which a fix was available. The bug allowed the attacker to bypass access restrictions. Had it been fixed, this would not have been possible."

(PA)

The investigation also revealed that two earlier attempts had been made by hackers to compromise TalkTalk databases.

"In spite of its expertise and resources, when it came to the basic principles of cyber-security, TalkTalk was found wanting," Denham added.

"Today's record fine acts as a warning to others that cyber security is not an IT issue, it is a boardroom issue. Companies must be diligent and vigilant. They must do this not only because they have a duty under law, but because they have a duty to their customers."